This article has been created to help explain what is Kraken Cryptor v2.0.7 ransomware and how you can remove this virus from your computer and try to restore encrypted files.
A new variant of Kraken Cryptor ransomware has been spotted in the wild, called v2.0.7. The virus imitates the wallpaper used by Cerber Ransomware and GandCrab ransomware viruses and just like these two, Kraken Cryptor v2.0.7 uses a random 5 A-Z 0-9 file extension on the files that have been encrypted by it and also adds the extension in the “Instructions-{suffix}.txt” ransom note. The end goal is to get the victims to pay ransom for the decryption of their important files. If your PC has been infected by Kraken Cryptor v2.0.7, we recommend that you read this article thoroughly as it aims to help you remove this virus and shows you how you can try and recover some of the encrypted files.
Threat Summary
| Name | Kraken Cryptor v2.0.7 |
| Type | Ransomware, Cryptovirus |
| Short Description | Aims to encrypt the files on the victims’ computers and then extort the victim to pay ransom to get them back. |
| Symptoms | Files are encrypted and the wallpaper is changed. A ransom note containing the file extension is added. |
| Distribution Method | Spam Emails, Email Attachments, Executable files |
| Detection Tool | See If Your System Has Been Affected by malware Download Malware Removal Tool | User Experience | Join Our Forum to Discuss Kraken Cryptor v2.0.7. |
| Data Recovery Tool | Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive. |
Kraken Cryptor v2.0.7 – Distribution
In order to get computers infected, Kraken Cryptor may use a malicious payload dropper. The malware authors of Kraken Cryptor v2.0.7 may spread it’s infection file via malicious e-mails that are spammed, carrying e-mail attachments that are malicious.
The e-mails usually mask the attachments as if they are from important nature, such as:
- Invoices.
- Purchase Receipts.
- Banking statements.
The e-mails may also imitate big companies from the likes of PayPal, eBay, DHL and other big organizations.
In addition to via e-mail, the malware may also spread by being uploaded on websites, pretending to be:
- Crack for a game or program.
- Portable version of a program.
- Patch.
- Keygen.
- Installer.
Kraken Cryptor v2.0.7 – More Information
When it infects your computer, the Kraken Cryptor v2.0.7 ransomware drops it’s main payload file. It has been reported at app.any.run with the following parameters:
→ Name: Kraken_2.0.7.exe
MD5: BCD2A924EE16F3A2ED4B77D0C09FC3A0
When executed, the virus drops the following virus files on the victim’s computer:
→ C:\Users\admin\AppData\Local\Temp\wallpaper.bmp
%ProgramData%\Microsoft.zip
%ProgramData%\sdelete.exe
%ProgramData%\sdelete64.exe
%ProgramData%\release.bat
%ProgramData%\Eula.txt
Once the files are dropped, the malware may establish different third-party connections with several hosts, create mutexes and perform other activities that allow it to act as an administrator on the user’s computer. The outcome of this is that Kraken Cryptor v2.0.7 may set the following wallpaper on the victim machine:
In addition to the wallpaper, the virus may also delete the shadow volume copies of the infected machine by executing the following commands:
→ sc stop VVS
sc stop wscsvc
sc stop WinDefend
sc stop wuauserv
sc stop BITS
sc stop ERSvc
sc stop WerSvc
cmd.exe /C bcdedit /set {default} recoveryenabled No
cmd.exe /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
C:\Windows\System32\cmd.exe” /C vssadmin.exe Delete Shadows /All /Quiet
Kraken Cryptor v2.0.7 – Encryption Process
To encrypt the files on the compromised computer, Kraken Cryptor v2.0.7 aims to scan for them, based on their file types. The virus looks for the most often used types of files, such as:
- Videos.
- Pictures.
- Audio files.
- Microsoft Office and other documents.
- Adobe reader documents.
- Archives.
- Databases.
- Virtual Drives.
Once encrypted, the ransomware renames the files, leaving them looking like the following:
Remove Kraken Cryptor v2.0.7 and Restore Encrypted Files
Before beginning removal process of any kind, we recommend that you backup your files intially.
In order to try remove Kraken Cryptor v2.0.7 from your computer, we recommend that you follow the removal instructions underneath this article. They have been created with the main goal of helping you locate and delete the malicious objects of this virus manually using the information in this article. However, if you do not feel confident in doing so or if the virus still remains, do not hesitate to take the automatic removal approach. It includes downloading an advanced anti-malware software, which will automatically take care of Kraken Cryptor v2.0.7 for you. And not only this, but such software also strives to protect your PC against future infections as well.
If you want to restore files that have been encrypted by this malware, you can try and follow the alternative methods for file recovery underneath. They may not be 100% effective for the file recovery process, but they may help restore at least some of your files.
Ventsislav Krastev
Ventsislav is a cybersecurity expert at SensorsTechForum since 2015. He has been researching, covering, helping victims with the latest malware infections plus testing and reviewing software and the newest tech developments. Having graduated Marketing as well, Ventsislav also has passion for learning new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management, Network Administration and Computer Administration of System Applications, he found his true calling within the cybersecrurity industry and is a strong believer in the education of every user towards online safety and security.
Follow Me:
